On Oct 30–31, 2026, at least 12 DeFi and token-launch websites were reportedly hit by a DNS/frontend hijack that Blockaid says served the Step Drainer toolkit. The toolkit tries to trick visitors into connecting wallets and signing malicious transactions. Reports say the compromise was at the website/DNS layer, not the underlying smart contracts. No aggregate loss, victim count, attacker wallets or fund flows have been published, and it is unclear whether all sites were compromised through the same access path.
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
As of Nov 1, 2026 (research timestamps 07:23–08:04 UTC), The Block reported that about $138,000 was traced to three EVM wallets and that this figure excludes possible losses on Solana or Aptos. Crypto Briefing reported that Name.com said the attack hit 15 customer domains, 10 of them tied to Vercel, and that Name.com restored the affected domains. Flap publicly confirmed a DNS hijack and told users not to visit, connect wallets, or sign transactions, and some projects reportedly moved to Vercel or Cloudflare nameservers. No arrests, lawsuits, or user compensation were found.
Research citing coinalertnews (Oct 31, 2026) says the ~$138,000 was split among three attacker wallets and routed through BNB Chain, Ethereum, Robinhood Chain, and Monad, though no wallet addresses were published. Research citing Crypto Briefing reports that Name.com restored the hijacked DeFi domains after the incident, and research citing PrimeXBT and Blockchain Breaches reports that StonkFun temporarily took its site offline before restoring it after moving infrastructure. The exact dates of these restorations were not given. No arrests, lawsuits, or user compensation were found in the research.
Research citing Coin Bureau and AInvest reports that 10 of the 12 affected domains were suspended at the registrar level (Name.com) by Saturday morning, Oct 31, 2026. The same research names additional affected sites beyond those already listed: Kintsu, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance, and ApeX (Flap and StonkFun were already known). The research found no verified developments after Oct 31, 2026 23:02 UTC, and the ~$138,000 figure is unchanged and still not independently verified.
One report (cited in the research) says Name.com's only public response so far was to direct users to its abuse form, with no fuller statement found, as of Oct 31, 2026. Blockaid, per the research, warned users not to connect wallets or sign transactions on the 12 affected sites. The research found no newer developments after Oct 31, 2026 23:02 UTC.
Flap publicly warned users not to interact with its website until further notice after confirming the DNS hijack, and affected teams generally urged users not to connect wallets or sign transactions (reported Oct 31, 2026, per PrimeXBT). A Binance Square post timed 20:01 UTC said Flap and K
Per The Block (reported Oct 31, 2026; the cited URL gives the date but no time), onchain data showed proceeds going to three attacker wallets in fixed 15%/55%/30% splits, and all 12 affected domains were registered with Name.com, though the hijack method is still unconfirmed. Coin Bureau said the roughly $138,000 traced figure excludes losses on Solana and Aptos, so the true total is uncertain. A report cited StonkFun saying its site was restored after migrating infrastructure, with on-chain operations unaffected and no known users impacted. No verified reports of frozen or recovered funds, arrests, or lawsuits were found.
As of 2026-10-31 16:05 UTC, Blockaid's count of Step Drainer-affected DeFi sites was 12: Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance, and APEX/ApeX DeFi. One report said about $138,000 had been traced as stolen so far and that 10 affected domains were suspended at the registrar level on Saturday morning (Oct 31, 2026), without naming the ten or confirming the suspensions were still active. Flap and Kintsu publicly confirmed DNS hijacks, and StonkFun reportedly moved to new infrastructure and briefly went offline.
According to reports, Blockaid first warned about Flap and Kintsu on October 30, 2026, then expanded the alert on October 31 to 10 more sites, for 12 in total. The named sites are Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and APEX.
Flap reportedly said its official website was hit by a DNS hijack, that visitors were being redirected to an unauthorized destination, and told users not to visit the site, connect wallets or sign transactions until further notice. StonkFun / LaunchOnSF reportedly took its site offline, moved to new infrastructure and later said it was back online. Reporting on LaunchOnSF says the attack was limited to the frontend/DNS layer, did not touch smart contracts, and that no user losses were reported.
The available reports do not give a verified total stolen, a victim count or a per-asset theft figure. Investigators reportedly had not established whether the 12 domains shared a single compromise point.
According to the reports, attackers compromised DNS or related domain infrastructure, or the frontend delivery path, so that normal-looking project domains loaded attacker-controlled pages or injected scripts. Visitors were then shown fraudulent wallet-connection requests and/or transaction-signing prompts.
If a user approved them, the Step Drainer toolkit could steal assets through wallet permissions or malicious transaction signatures. Because the compromise sat at the web layer, the underlying protocols were reportedly not breached, but anyone using the hijacked domains could be exposed. One project-side comment cited in coverage reportedly said risk was limited to users who visited during a short tampering window and then approved prompts.
No confirmed on-chain fund movement, mixer or bridge use, exchange deposits, freezes or recoveries are reported in the available sources. No attacker wallet addresses have been published.
Affected teams reportedly warned users not to connect wallets or sign transactions on flagged domains. Flap issued a do-not-use warning. StonkFun / LaunchOnSF took its site offline, moved to new infrastructure and restored it. The available reporting does not confirm paused withdrawals, compensation plans, insurance-fund payouts, or regulator or police involvement.
No verified losses or victim count. No verified price impact on affected tokens or the wider market was found in the reports. The main impact is on user trust and the risk to anyone who interacted with the affected sites during the compromise window.
55% negative · 5% positive · the rest neutral · themes: Warnings not to connect wallets or sign, Frontend/DNS risk rather than smart contract risk, Uncertainty over losses and root cause, Reassurance that smart contracts were reportedly untouched
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice.
VaultX